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A court decision concerning the release of patient 
records has been the subject of online discussion in 
recent days. Despite reports, the case didn't involve the 
issue of Subject Access Requests (SARs) but rather the 
release of patient records by order of the courts. 
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Replying to @1COnews 

As such, the legal position regarding GP practices responding to SARs 
remains unchanged and surgeries should follow ICO guidance and advice 
from the BMA on how to comply with the law. 
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ICO. Data controllers are responsible for providing a SAR response to the 
individual or their appointed representative. A person should not have to 
take action to receive the information, such as by collecting it from the 
controller's premises, unless they agree to do so. 
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The ICO plans to consult in the near future on providing further detailed 
guidance for organisations on how to comply with their SAR obligations. 
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Our current SARs guidance can be found here: 


